CVE-2024-41665

What it actually does

Stored XSS in the Democratic Playlist configuration feature allows a Content Manager to persist a malicious script (such as an SVG onload handler) in the playlist Name field; the script executes in the browser of any user or administrator who later views democratic.php, enabling cookie theft and session impersonation.

Why it matters to the business

Attackers who already hold Content Manager rights can hijack administrator sessions, potentially leading to full application compromise, data exposure, or further privilege escalation with minimal additional effort.

How an attack unfolds

An authenticated user with Content Manager permissions crafts a Democratic Playlist whose Name contains an executable script payload. When any administrator or regular user subsequently accesses the Democratic functionality through democratic.php, the stored script runs in their browser context, exfiltrating cookies or performing actions on their behalf.

How to fix it

Upgrade Ampache to version 6.6.0 or later, which contains commit 860592aa10a12cec318ed7eee15ff509b06a5331 that sanitizes the Democratic Playlist Name field. Until the upgrade is complete, restrict Content Manager permissions and monitor access to democratic.php.

How to confirm the fix worked

Confirm the installed commit or version is at or after 860592aa10a12cec318ed7eee15ff509b06a5331; attempt to create a Democratic Playlist with a test XSS payload and verify that the payload is escaped or rejected on subsequent loads of democratic.php.

Typical attack path

1. Obtain or compromise a Content Manager account
2. Navigate to Playlists → Democratic → Configure Democratic Playlist
3. Set the Name field to a payload such as <svg onload=alert(8)>
4. Save the playlist
5. Wait for an administrator or user to load democratic.php
6. Capture session cookies or perform actions in the victim's context

How to detect it

Review web server and application logs for repeated or anomalous requests to democratic.php; search playlist metadata or database entries for unescaped script tags or SVG onload attributes; monitor for unexpected cookie exfiltration or new administrator sessions originating from unexpected locations.

• democratic.php
• <svg onload=
• Playlists - Democratic - Configure Democratic Playlist

What your security team should do

• Immediately schedule upgrade to Ampache 6.6.0 or the referenced commit
• Temporarily reduce the number of accounts holding Content Manager rights
• Add WAF or input-filtering rules that block common XSS patterns on playlist name fields
• Enable enhanced logging for all accesses to democratic.php